CVE-2017-7921
Hikvision Multiple Products Improper Authentication Vulnerability
- Published
- May 6, 2017
- Updated
- Mar 6, 2026
- Assigning CNA
- icscert
- Evidence observed
- Mar 5, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 100.0%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.
Sources
modules/auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921.rb
Metasploit Framework modulesDeclared conditions
- verification: check_declared($.auxiliary_admin/http/hikvision_unauth_pwd_reset_cve_2017_7921.check)
modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Metasploit Framework modulesDeclared conditions
- verification: check_declared($.auxiliary_gather/hikvision_info_disclosure_cve_2017_7921.check)
http/cves/2017/CVE-2017-7921.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: word($.matchers[*].type)
- CVE-2017-7921Exploit
CVE-2017-7921 is a critical vulnerability (CVSS score: 9.8) affecting multiple Hikvision IP camera and DVR models, first disclosed in 2017. It stems from an improper authentication flaw that allows unauthenticated remote attackers to bypass login mechanisms and gain unauthorized access to sensitive system information
- hikvision_probeScanner
Identify hikvision ip and probe for cve-s (CVE-2017-7921, CVE-2022-28171, CVE-2021-36260)
- CVE-2017-7921Exploit
Exploit tool for CVE-2017-7921 in Hikvision cameras, supporting vulnerability detection, credential extraction, and snapshot retrieval via command-line interface.
- CVE-2017-7921Exploit
CVE-2017-7921 exploit. Allows admin password retrieval and automatic snapshot download.
- CVE-2017-7921-EXPExploit
Exploit for CVE-2017-7921 targeting Hikvision devices with improper authentication. Retrieves user lists, camera snapshots, and configuration files via crafted HTTP requests.
- HikVision-CVE-2017-7921Scanner
Multi-threaded scanner to identify HikVision cameras vulnerable to CVE-2017-7921 by testing the ONVIF snapshot endpoint for unauthorized access.
Decrypts Hikvision IP camera configuration files extracted via CVE-2017-7921 authentication bypass, recovering user credentials from weakly encrypted configs using a static key.
- CVE-2017-7921-Writeup-2026Research
Vulnerability research write-up on CVE-2017-7921 — a critical unauthenticated auth bypass in Hikvision IP cameras/DVRs/NVRs, covering root cause, exploitation path, detection, and remediation.
Decrypts Hikvision IP camera configuration files extracted via CVE-2017-7921 authentication bypass, revealing user credentials and device settings.
- AnonHikExploit
Python script get image from Hikvision camera with CVE-2017-7921 vulnerability
- CVE-2017-7921Exploit
Exploit code for CVE-2017-7921, an authentication bypass vulnerability in Hikvision cameras, allowing unauthorized access.
- CVE-2017-7921Exploit
海康威视未授权访问检测poc及口令爆破
- IngramScanner
网络摄像头漏洞扫描工具 | Webcam vulnerability scanning tool
- CVE-2017-7921-EXPExploit
Hikvision camera CVE-2017-7921-EXP
- CVE-2017-7921-rewriteExploit
simple CVE-2017-7921 rewrite in python by me. for educational purposes only!
- hikivisionExploit
Exploit for CVE-2017-7921 targeting Hikvision IP cameras, enabling remote credential extraction and device takeover via unauthenticated access.
- cve-2017-7921-golangExploit
Hikvision IP camera access bypass exploit, developed by golang.
- CVE-2017-7921Exploit
HikVision Auth Bypass CVE, tool is able to extract credentials, and take snapshots based on magic cookie or supplied credentials.
- hikvision-exploiterExploit
CVE-2017-7921, CVE-2021-36260 updated 21/01/2026
- Hikvision-City-HunterExploit
This tool is a modern evolution of older PoCs like those for CVE-2017-7921 and ICSA-17-124-01, updated for 2025 with live console output, threading for speed, and honeypot filtering (skips devices with >12 open ports). It's built for red teamers, bug bounty hunters, and security researchers to identify
用于借助FOFA快速测试海康威视的CVE-2017-7921漏洞，并且给出登陆账号和密码，并输出json文件。
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.